1. Who we are
OneCoach is operated by:
- Legal entity: SMDF Company LLC-FZ
- Registered address: Meydan Grandstand, 6th floor, Meydan Road, Dubai, United Arab Emirates
- EU representative / Data Protection Officer: support@onecoachapp.io
- General privacy contact: support@onecoachapp.io
This Privacy Policy explains how OneCoach ("OneCoach", "we", "us", "our") collects, uses, shares, and protects personal data when you use our web dashboard at https://app.onecoachapp.io, our iOS and Android mobile apps, and our marketing site at https://onecoachapp.io (together, the "Service"). It is written in plain English but is intended to be legally complete.
OneCoach is a platform for independent fitness coaches and the clients they invite. Because of this two-sided structure, our role under data protection law changes depending on the data involved. Please read Section 2 carefully — it determines who you should contact to exercise your rights over a given piece of data. If you are in the EEA or the UK, you can reach our EU representative / DPO using the contact details above.
2. Our roles: controller vs. processor
OneCoach is a business-to-business-to-consumer ("B2B2C") platform. There are two types of users:
- Coaches — independent professionals who create a OneCoach account to run their coaching business and who invite their own clients.
- Clients — individuals invited by a coach, who mainly use the mobile app.
Our legal role depends on whose data is being processed:
| Context | OneCoach's role | What this means |
|---|---|---|
| Coach account data (registration, profile, billing, use of the dashboard) and operation of the Service itself | Controller | We decide why and how this data is processed and are directly responsible for it. |
| Client data that a coach collects and manages through OneCoach (workouts, metrics, check-ins, messages, progress photos, and so on) | Processor | The coach is the controller of that data. We process it only on the coach's documented instructions to provide the Service. |
Practical effect for clients: Your coach decides what client data to collect and how to use it within the Service, and is responsible for having a lawful basis and their own privacy notice. For data your coach controls, you should direct requests (such as access or deletion) to your coach first. We will assist coaches in responding to those requests as their processor. Where we independently determine purposes — for example, securing the platform or billing coaches — we act as controller and you may contact us directly.
This Privacy Policy describes OneCoach's own practices as a controller and explains, for transparency, how we handle data as a processor. It is not a substitute for the privacy notice your coach must provide to you.
3. Information we collect
We collect only the data needed to operate the Service. We do not buy personal data from data brokers.
| Category | Examples | Source |
|---|---|---|
| Account & identity | Name, email address, authentication credentials (stored only as a salted hash), profile details | Provided by the coach or client at sign-up / on invitation |
| Health & fitness data (sensitive) | Workouts and workout logs, exercise history, body metrics and metric entries, daily step counts, meal plans and macro/nutrition targets, check-in form submissions and answers, progress photos | Entered by the user (coach or client) in the app |
| Messages | In-app messages between a coach and their clients | Created by users |
| Device data | Mobile push-notification tokens; basic device and app information (e.g., device model, OS version, app version) | Collected automatically by the mobile app |
| Payment metadata | Subscription status, transaction records. Card and payment-instrument details are handled directly by Stripe and are not stored on OneCoach servers. | Generated during billing via Stripe |
| Records & logs | User consent records, security and audit logs | Generated automatically by the Service |
We do not use third-party analytics, advertising, or tracking technologies (see Section 14).
4. How and why we use information, and our legal bases
Under the EU/UK GDPR we must have a lawful basis for each processing purpose. The table below maps our purposes (where OneCoach is a controller) to those bases.
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Create and administer coach accounts; provide the dashboard and app | Account & identity, device data | Performance of a contract (Art. 6(1)(b)) |
| Enable coach–client messaging and core coaching features | Account & identity, messages, health & fitness data | Contract (Art. 6(1)(b)); for client data we act as processor on the coach's instructions |
| Process subscriptions and billing | Payment metadata, account & identity | Contract (Art. 6(1)(b)) |
| Send transactional emails (invitations, security notices, receipts) | Account & identity, email address | Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
| Send push notifications you have enabled | Device push tokens | Consent (Art. 6(1)(a)) via your device permission; legitimate interests for service-critical alerts |
| Secure the Service, prevent fraud and abuse, keep audit logs | Security/audit logs, account & identity, device data | Legitimate interests (Art. 6(1)(f)); legal obligation (Art. 6(1)(c)) where applicable |
| Maintain, debug, and improve the Service | Account & identity, device data, logs | Legitimate interests (Art. 6(1)(f)) |
| Handle health & fitness (sensitive) data | See Section 5 | Explicit consent (Art. 9(2)(a)) — see Section 5 |
| Comply with legal obligations and respond to lawful requests | Any relevant data | Legal obligation (Art. 6(1)(c)) |
| Keep records of consent | Consent records | Legal obligation / legitimate interests |
Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms; you can object at any time (see Section 10). Where we rely on consent, you can withdraw it at any time without affecting processing already carried out.
5. Health & fitness data (sensitive category)
Some of the data in the Service — body metrics, workout and nutrition logs, check-in answers, step counts, and progress photos — reveals information about your physical health and fitness. We treat this as a special/sensitive category and apply heightened protection.
- Legal basis: Where OneCoach acts as a controller, we process this data on the basis of explicit consent (GDPR Art. 9(2)(a)). Where the data belongs to a coach's client, the coach is the controller and is responsible for obtaining any consent required from the client; OneCoach processes it only as the coach's processor.
- Minimisation: We collect only what users choose to enter and use it solely to provide coaching features.
- No secondary use: We do not use health & fitness data for advertising, profiling, or sale, and we never sell it.
- Withdrawal: You can withdraw consent at any time; where you do, we (or your coach) will stop the relevant processing and delete or return the data as described in Sections 8 and 10.
6. How we share information
We share personal data only as needed to run the Service. We use vetted third-party providers ("subprocessors") who process data on our behalf under written contracts that require appropriate safeguards.
| Provider | Purpose | Data involved |
|---|---|---|
| Amazon Web Services (AWS S3) | File & media storage | Progress photos, exercise media, other uploaded files |
| Stripe | Payment processing & subscription billing | Payment metadata (card data is handled directly by Stripe) |
| Resend | Transactional email delivery | Email address, email message content |
| Firebase Cloud Messaging (Google) | Mobile push notifications | Device push tokens |
| Hosting & database provider | Application hosting and primary data storage | All stored application data |
We may also share data:
- Between a coach and their clients — that is the core purpose of the Service (messages, plans, check-ins).
- For legal reasons — to comply with law, enforce our Terms of Service, or protect the rights, safety, and security of users and the public.
- In a business transfer — if OneCoach is involved in a merger, acquisition, or sale of assets, subject to this policy.
We do not sell your personal data, and we do not share it for cross-context behavioral advertising. We have no third-party advertising or tracking cookies (see Section 14).
7. International data transfers
OneCoach and its subprocessors may process data in countries outside the EEA/UK, including the United States. Where we transfer personal data out of the EEA or UK to a country without an adequacy decision, we rely on appropriate safeguards, principally the European Commission's Standard Contractual Clauses (SCCs) (and the UK International Data Transfer Addendum where relevant), together with any supplementary technical and organisational measures needed to protect the data. You can request more information about these safeguards using the contact details in Section 17.
8. Data retention
We keep personal data only as long as necessary for the purposes described in this policy:
- Coach account data: for as long as the account is active, and for a reasonable period afterwards to meet legal, tax, and accounting obligations.
- Client data (processor role): for as long as the coach's account and relationship require it. When a coach deletes client data or closes their account, we delete or return it in line with our agreement with the coach, subject to backups being overwritten on our normal cycle.
- Payment metadata: as required by tax and financial-record laws.
- Security & audit logs: for a limited period appropriate to security and legal needs.
When data is no longer needed, we delete or irreversibly anonymise it.
9. Security
We use technical and organisational measures appropriate to the risk, including: encryption of data in transit; storage of authentication credentials only as salted hashes; access controls and least-privilege permissions; audit logging; and use of reputable infrastructure providers. Card data is handled entirely by Stripe and never touches our servers. No system is perfectly secure, but we work to protect your data and to notify affected users and regulators of a personal data breach where the law requires.
10. Your GDPR rights
If you are in the EEA or UK, you have the following rights over your personal data:
- Access — obtain a copy of the data we hold about you.
- Rectification — correct inaccurate or incomplete data.
- Erasure — ask us to delete your data ("right to be forgotten").
- Restriction — ask us to limit processing in certain circumstances.
- Portability — receive your data in a structured, machine-readable format and have it transmitted to another provider where technically feasible.
- Objection — object to processing based on legitimate interests.
- Withdraw consent — where we rely on consent (including for health & fitness data and push notifications), withdraw it at any time.
- Complain — lodge a complaint with your local data protection supervisory authority.
Important for clients: For data that your coach controls (see Section 2), your coach is the controller. Please direct access, correction, and deletion requests to your coach in the first instance; we will support your coach in fulfilling them. For data where OneCoach is the controller, contact us at support@onecoachapp.io or via the DPO contact in Section 1. We will respond within the timeframes required by law (generally one month) and will not charge a fee except where permitted.
11. California privacy rights (CCPA/CPRA)
If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, gives you specific rights. This section applies where OneCoach is a "business" with respect to your personal information.
Categories of personal information we collect (as defined by the CCPA): identifiers (name, email); account credentials; health and fitness information (sensitive personal information); commercial information (subscription and transaction records); electronic/device information; user content (messages, photos, form answers). We collect these from the sources and for the purposes described in Sections 3–4.
Your rights:
- Right to know — request the categories and specific pieces of personal information we have collected, the sources, purposes, and any recipients.
- Right to delete — request deletion of personal information we collected from you, subject to legal exceptions.
- Right to correct — request correction of inaccurate personal information.
- Right to opt out of sale/sharing — see below.
- Right to limit use of sensitive personal information — we use health & fitness data only to provide the Service, which is a use you cannot be required to opt out of because we do not use it for any purpose beyond providing the requested services.
We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. We have not done so in the preceding 12 months.
Non-discrimination: We will not discriminate against you for exercising your rights — no denial of service, different pricing, or reduced quality.
Authorized agents: You may use an authorized agent to submit a request; we may require proof of authorization and verification of your identity.
To exercise these rights, contact support@onecoachapp.io. As with GDPR requests, for data controlled by your coach you should contact your coach, and OneCoach will assist as service provider.
12. Children's privacy
The Service is not intended for children. You must be at least 16 years old to use OneCoach. We do not knowingly collect personal data from anyone under 16. Coaches must not invite or enter data about clients under 16. If we learn that we hold data about a person under 16 without appropriate authority, we will delete it promptly. If you believe a minor has provided us data, contact support@onecoachapp.io.
13. Push notifications & device permissions
The mobile app may request device permissions (for example, to send push notifications, or to access your camera or photo library to upload progress photos). These permissions are optional and controlled by you in your device settings. We use push tokens only to deliver notifications you have enabled; you can disable notifications at any time in your device or app settings. Turning off a permission may limit related features.
14. Cookies
OneCoach uses only a first-party authentication/session cookie that is strictly necessary to keep you signed in and to operate the Service securely. We do not use third-party analytics, advertising, or tracking cookies, and we do not build advertising profiles or track you across other websites or apps. Because the cookie we use is strictly necessary, it does not require consent under the ePrivacy rules, but you can clear it via your browser at any time (which will sign you out).
15. App Store & Google Play data disclosures
To align with Apple's App Store privacy ("Nutrition Label") and Google Play's Data Safety disclosures, we declare that the app collects and processes the following categories, linked to the identity of the account: contact info (name, email); health & fitness data; user content (messages, photos, form answers); and device identifiers (push tokens). This data is used to provide app functionality and is not used for tracking or advertising and is not sold. Our store disclosures are kept consistent with this Privacy Policy; where a store's definitions differ, this policy governs our actual practices.
16. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Effective date" above and, where appropriate, notify you through the Service or by email. Your continued use of the Service after an update takes effect means you accept the revised policy.
17. How to contact us
- Privacy & general questions: support@onecoachapp.io
- Operating entity: SMDF Company LLC-FZ, Meydan Grandstand, 6th floor, Meydan Road, Dubai, United Arab Emirates
- EU representative / DPO: support@onecoachapp.io
For how we handle your data as a processor, and for rights over coach-controlled data, please also contact your coach. For details on the rules governing your use of the Service, see our Terms of Service.